feat: problem rules v1 brute-force, privilege spike, host silence (d1-3)

- Threshold rules on ingest; heartbeat auto-resolves host silence

- Config thresholds in sac-api.env; unit tests

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/env.native.example

@@ -29,4 +29,12 @@ SAC_HEARTBEAT_STALE_MINUTES=780
 # Корреляция Problems: host + type + rule в одном open Problem (минуты)
 SAC_PROBLEM_CORRELATION_WINDOW_MINUTES=60
 
+# rule:brute_force_burst (ssh.login.failed / rdp.login.failed)
+SAC_BRUTE_FORCE_WINDOW_MINUTES=15
+SAC_BRUTE_FORCE_THRESHOLD=30
+
+# rule:privilege_spike (privilege.sudo.command)
+SAC_PRIVILEGE_SPIKE_WINDOW_MINUTES=10
+SAC_PRIVILEGE_SPIKE_THRESHOLD=10
+
 CORS_ORIGINS=*